What BIMI is and what it does for you
BIMI (Brand Indicators for Message Identification) is a specification from the AuthIndicators Working Group that lets domain owners publish a logo which receivers display next to authenticated messages. The mail client does not take the logo from the message but from the DNS of the sending domain, and only when the message has passed DMARC. An attacker spoofing the domain therefore does not get the logo.
The benefit is twofold. For the brand, a logo in the inbox means recognition, and senders report measurably higher open rates because the message stands out among text avatars. For security, BIMI is above all a lever to finally enforce DMARC: without p=quarantine or p=reject there is no logo, and for many marketing teams that is the first convincing argument for a strict policy.
Prerequisite: DMARC at enforcement
BIMI requires working email authentication. The domain needs SPF and DKIM, and at least one of them must align with the From domain. On top of that sits DMARC with a policy that actually does something: p=quarantine or p=reject. With p=quarantine, pct must be 100 or absent, because pct=10 means 90 percent of failing messages are still delivered untouched.
The subdomain policy counts as well. If the record contains sp=none, enforcement does not apply to subdomains and most receivers will decline BIMI. Either remove sp= entirely so every subdomain inherits the main policy, or set sp= to quarantine or reject. If your domain is still on p=none, moving to a strict policy is the first step; everything else comes after.
Minimum:
_dmarc.example.com. TXT "v=DMARC1; p=quarantine; rua=mailto:dmarc@example.com"
Better:
_dmarc.example.com. TXT "v=DMARC1; p=reject; sp=reject; rua=mailto:dmarc@example.com"The logo as SVG Tiny PS
BIMI accepts neither PNG nor arbitrary SVG, only the SVG Portable/Secure profile, SVG Tiny PS for short. It is a subset of SVG Tiny 1.2 with everything removed that a mail client cannot render safely. The file must not contain scripts, external references, embedded raster images loaded via URL, or animation. The root element must carry version="1.2" and baseProfile="tiny-ps", must not have x and y attributes, and needs a title element with the brand name.
The logo has to be square, meaning a viewBox with equal width and height. Clients crop the square to a circle depending on the interface, so the actual artwork belongs in the centre with some margin. A transparent background is allowed but not recommended, because the logo then sits on black or white depending on dark mode. A filled background in the brand colour looks the same everywhere. File size should stay under 32 KB; the heavy path data from illustration software can usually be shrunk considerably with an SVG optimiser.
There are several ways to convert. Adobe Illustrator offers a direct export to SVG Tiny PS through a script from the AuthIndicators Working Group. Alternatively, export a regular SVG and have a BIMI SVG converter rewrite it; several certificate issuers provide such tools free of charge. The file should end up starting roughly like this:
<?xml version="1.0" encoding="UTF-8"?>
<svg xmlns="http://www.w3.org/2000/svg" version="1.2" baseProfile="tiny-ps" viewBox="0 0 512 512">
<title>Example Inc</title>
<rect width="512" height="512" fill="#0a3d62"/>
<path d="..." fill="#ffffff"/>
</svg>Hosting the logo and creating the DNS record
The SVG file must be reachable over HTTPS with a valid certificate and without a redirect to http. The web server should serve it with the content type image/svg+xml. The URL is part of the DNS record, so choose a path you will not restructure with every website relaunch, for example https://example.com/bimi/logo.svg.
The BIMI record is a TXT record under the selector default and the label _bimi. The l= tag holds the URL of the logo, the optional a= tag the URL of the certificate in PEM format. Without a certificate, leave a= out or empty.
Without a certificate:
default._bimi.example.com. TXT "v=BIMI1; l=https://example.com/bimi/logo.svg;"
With a VMC or CMC:
default._bimi.example.com. TXT "v=BIMI1; l=https://example.com/bimi/logo.svg; a=https://example.com/bimi/vmc.pem"The default selector is used when the message carries no BIMI-Selector header. Through that header a sender can pick a different selector, for instance to show a different logo for a product line. Few domains need this in practice, and most receivers only honour the header if it is covered by the DKIM signature anyway. Stick with default unless you have a concrete reason not to.
VMC and CMC: when you need a certificate
A Verified Mark Certificate (VMC) is an X.509 certificate confirming that the organisation behind the domain owns a registered trademark and that the logo in the SVG file matches that mark. The issuers are DigiCert and Entrust. Vetting resembles that for extended validation certificates: proof of the organisation, proof of the trademark registration with a recognised office such as the USPTO, EUIPO or UKIPO, and an identity check of a representative. The certificate embeds the logo itself; receivers compare it against the file from l=.
The Common Mark Certificate (CMC), available since 2024, is the alternative for organisations without a registered trademark. It requires evidence that the logo has been in use for at least twelve months, typically shown through archived web pages. With a CMC, Gmail displays the logo but not the blue checkmark, which is reserved for VMCs. Both certificates cost roughly 1,000 to 1,500 US dollars per year, the CMC somewhat less. Add the cost of a trademark filing if you do not have one yet.
Whether you need a certificate depends on where the logo should appear. Gmail and Apple Mail show it only with a VMC or CMC. Yahoo and AOL display logos without a certificate as long as DMARC is enforced and the sender has a decent reputation. Microsoft started rolling out BIMI support in Outlook in 2025, also requiring a certificate. For domains that mostly send to consumers with Gmail addresses, the certificate is effectively mandatory. For a domain with mostly business recipients it is often not worth the money, and a record without a= does no harm.
Step by step
The order matters because the certificate needs the finished logo and the record needs the certificate. If you create the record first and swap the logo later, the certificate has to be reissued.
- Check DMARC: p=quarantine or p=reject, pct=100 or no pct, sp= not weaker than p=. Raise the policy first if necessary.
- Create the logo as a square SVG, convert it to SVG Tiny PS, set the title, fill the background, check the file size.
- Host the logo at a permanent HTTPS URL, open it in a browser and verify the content type.
- If needed, apply for a VMC or CMC with DigiCert or Entrust. The logo from step 2 is uploaded during the process and must not be changed afterwards.
- Place the certificate as a PEM file next to the logo, also over HTTPS.
- Create the TXT record at default._bimi with l= and, if you have one, a=.
- After the TTL has expired, verify the record with the BIMI checker and send a test message to a Gmail and a Yahoo mailbox.
Checking it and common mistakes
The DomainWarn BIMI checker tests the whole chain: whether the DMARC policy meets the requirements, whether the record at default._bimi is syntactically correct, whether the SVG file is reachable over HTTPS and conforms to the Tiny PS profile, and whether a certificate is declared and retrievable. If everything is green there and the logo still does not show, the cause is usually reputation or waiting time, not configuration.
The mistakes that come up most often in practice:
- SVG not in the Tiny PS profile: baseProfile missing, scripts or external references included, or a plain Illustrator SVG with x and y attributes
- DMARC at p=none or with pct below 100, so receivers do not regard the domain as protected
- Logo served over http or behind a redirect, so the fetch fails
- Record at _bimi.example.com or bimi.example.com instead of default._bimi.example.com
- Logo not square because the viewBox from the export tool has the dimensions of the artwork rather than a square
- Certificate does not match the logo: the SVG was optimised or recoloured once more after issuance and the hashes no longer agree
- Certificate issued for a different domain than the one the record lives under
- Logo with a transparent background that becomes unreadable in dark mode
When the logo shows up
After the record is published, Yahoo usually takes a few days, Gmail one to two weeks. Providers cache the logo and the validation results, and Gmail additionally requires that the domain sends mail with DMARC pass on a regular basis and has no conspicuous spam rate. A domain that sends only occasionally or moved to reject just recently takes longer. The logo also appears only on messages that actually passed DMARC; a single message through a non aligned sender still shows the initials.
If you replace the logo later, the same waiting time applies, and with a VMC or CMC a new certificate is due. Plan logo changes together with the certificate term.
Frequently asked questions
- Can I set up BIMI without a certificate?
- Yes. The record is valid without a=, and Yahoo and AOL will still show the logo. Gmail, Apple Mail and Outlook require a VMC or CMC. A record without a certificate is a sensible first stage because it lets you verify the logo, hosting and DMARC properly before spending money.
- Is p=quarantine enough for BIMI?
- Yes, as long as pct is 100 or absent and the subdomain policy is not none. Some receivers weigh reject when deciding whether to display the logo, but the specification only demands enforcement.
- What happens if the logo is temporarily unreachable?
- Receivers cache the logo for a while, so a short outage usually goes unnoticed. If the file is unreachable for days or has changed, the logo disappears and the waiting period starts over. That is why the URL belongs in your monitoring.